Feb 18 2019
06:50 AM
- last edited on
Apr 07 2022
05:41 PM
by
TechCommunityAP
Feb 18 2019
06:50 AM
- last edited on
Apr 07 2022
05:41 PM
by
TechCommunityAP
With having the ability to search sing-in logs I am trying to figure out the correct query for the following. I want to search for when a single account signs in from multiple IPs. My end goal here is to create a search query that will run say every 15 mins and alert when a user account has been logged in from multiple IP addresses over a specified time frame. My goal is to use this to help pick up on compromised accounts quicker.
I know how to setup the alerting part with a query, im just stuck at how to write the part that only picks up when multiple IPs are used....or if its even possible. I don't care if there are multiple sign-ins from the same IP in this scenario, just when different IPs are used for the same user account.
User "bob" signs in from IP x.x.x.1 and two mins later x.x.x.2 and then 5 mins later x.x.x.3. I want to know about this and trying to figure out a way how using a query of the sign-in logs.
Thanks
Feb 18 2019 10:37 PM
SolutionHi,
I do not have Azure AD logs in my env but I can simulate the same thing via Azure Activity logs. The most basic query is this:
AzureActivity | extend httpdata = parse_json(HTTPRequest) | summarize AggregatedValue = dcount(tostring(httpdata.clientIpAddress)) by ResourceId
Don't mind the usage of parse_json that is specific for that log. The most important to notice is that I use dcount() and count it by Resource Id. In your case inside dcount will be the column of the IP address and ResourceId for you will be the user name. You will not get a list of which are IPs but you will get their count. This is the most basic query that should work for the most basic number of results alert.
Mark this reply as answer if it has helped you.
Feb 19 2019 05:45 AM
Feb 19 2019 08:22 AM
Hi,
That is possible as well but you need to verify if the alert will work. Alerts require specific things like AggregatedValue for example.
The example query will be:
AzureActivity | extend httpdata = parse_json(HTTPRequest) | summarize IpList = makeset(tostring(httpdata.clientIpAddress)) by ResourceId | extend AggregatedValue = array_length(IpList) | sort by AggregatedValue desc
In your case:
SigninLogs | where ResultType == "0" | summarize IpList = makeset(IPAddress) by UserPrincipalName | extend AggregatedValue = array_length(IpList) | where AggregatedValue > 5
Feb 19 2019 10:49 AM
Feb 18 2019 10:37 PM
SolutionHi,
I do not have Azure AD logs in my env but I can simulate the same thing via Azure Activity logs. The most basic query is this:
AzureActivity | extend httpdata = parse_json(HTTPRequest) | summarize AggregatedValue = dcount(tostring(httpdata.clientIpAddress)) by ResourceId
Don't mind the usage of parse_json that is specific for that log. The most important to notice is that I use dcount() and count it by Resource Id. In your case inside dcount will be the column of the IP address and ResourceId for you will be the user name. You will not get a list of which are IPs but you will get their count. This is the most basic query that should work for the most basic number of results alert.
Mark this reply as answer if it has helped you.